feat: debian packaging, release pipeline, and build scripts

- debian/postinst: create daena user, directories, reload systemd
- debian/prerm: stop and disable service on removal
- scripts/build-deb.sh: build self-contained .deb with all deps
- CI: add release job triggered by v* tags, builds wheel + .deb,
  uploads both to GitHub Release

.github/workflows/ci.yml

@@ -3,6 +3,7 @@ name: CI
 on:
   push:
     branches: [main, dev]
+    tags: ["v*"]
   pull_request:
     branches: [main]
 
@@ -36,3 +37,40 @@ jobs:
         run: uv sync --extra dev
       - name: Run tests
         run: uv run pytest tests/ -v
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [lint, test]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install uv
+        run: pip install uv --no-cache-dir
+
+      - name: Build wheel
+        run: uv build
+
+      - name: Install system deps
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq fakeroot dpkg-dev
+
+      - name: Build .deb package
+        run: bash scripts/build-deb.sh "${GITHUB_REF_NAME#v}"
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          name: "daena ${{ github.ref_name }}"
+          body: |
+            ## daena ${{ github.ref_name }}
+
+            See `CHANGELOG.md` for details.
+          files: |
+            dist/*.whl
+            dist/*.deb
+          fail_on_unmatched_files: true